Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub censored my research data

gwillem.gitlab.io

Post reply on HN
Print view View original

131–140 of 206 posts

Re: GitHub censored my research data

#131

Post by Mandatum »

sh1392 wrote: post #39

We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ( https://about.gitlab.com/terms/ ). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely…

I don't believe it is your place to do so. You have the right to, but you have no real reason to. You will suffer no consequences from removing that list.

Responsible disclosure works because companies are responsive to disclosure.

Full disclosure works because companies are negligent and they've been outed.

The author did contact said websites, it is their responsibility to fix the issue in a timely manner. Removing the content was akin to a newspaper removing stories relating to certain politicians to protect them. It is censorship.

Re: GitHub censored my research data

#135

Post by [deleted] »

gwillem wrote: post #40

GL sent me this statement. For the record, I didn't publish vulnerable systems, I published stores that have malware. --- Willem, GitLab has opted to remove the list of servers that you posted in your snippet. GitLab views the exposure of the vulnerable systems as egregious and will not abide it. While GiLab reserves the right take further action, up to and including termination ( https://about.gitlab.com/terms/ ), w…

[deleted]

Re: GitHub censored my research data

#136

Post by kkirsche »

sh1392 wrote: post #39

We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ( https://about.gitlab.com/terms/ ). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely…

You still screwed up handling things. Did you very they are actually vulnerable? Or are you hoping you got it right? Cause if the later you really shouldn't remove something you don't know anything about

Re: GitHub censored my research data

#138

Post by BoorishBears »

zAy0LfpBZLC8mAC wrote: post #44
gwillem wrote: post #40

GL sent me this statement. For the record, I didn't publish vulnerable systems, I published stores that have malware. --- Willem, GitLab has opted to remove the list of servers that you posted in your snippet. GitLab views the exposure of the vulnerable systems as egregious and will not abide it. While GiLab reserves the right take further action, up to and including termination ( https://about.gitlab.com/terms/ ), w…

And even if it were (a list of vulnerable systems, that is), why the fuck do they think that they should censor serious journalism? If you operate a public venue, then it is an important societal role of journalism to report on it if that public venue poses a risk to the public, whether that might also have negative consequences for the people operating it is completely irrelevant.

I really hate this trend of journalism leaking into services like Github. We have secure ways to share files with high redundancy, why put a service like Github/Gitlab in the line of fire when their primary goal is to enable open collaboration, vs open information.

Re: GitHub censored my research data

#139

Post by nihonde »

vog wrote: post #43
nihonde wrote: post #10

Earlier quoted context omitted.

Compilations can be copyrighted. There's a long legal history on the topic. Also, logos are generally a topic for trademark laws, not so much copyright.

> Compilations can be copyrighted. There's a long legal history on the topic. This is true, but totally irrelevant as it misses the point of the question.

Actually, you're wrong. The DMCA was used as a premise for takedown on the basis of purported copyright infringement. I was pointing out that such a claim, however spurious you may think it is, would likely hinge on the claimant's exclusive rights in the compilation. I can't see any other theory that would support a DMCA takedown. Again, it's irrelevant to the question whether or not you think the claim had merit. Also, the question conflated trademark with copyright.

Re: GitHub censored my research data

#140

Post by PuffinBlue »

BoorishBears wrote: post #138
zAy0LfpBZLC8mAC wrote: post #44

Earlier quoted context omitted.

And even if it were (a list of vulnerable systems, that is), why the fuck do they think that they should censor serious journalism? If you operate a public venue, then it is an important societal role of journalism to report on it if that public venue poses a risk to the public, whether that might also have negative consequences for the people operating it is completely irrelevant.

I really hate this trend of journalism leaking into services like Github. We have secure ways to share files with high redundancy, why put a service like Github/Gitlab in the line of fire when their primary goal is to enable open collaboration, vs open information.

What services are you referring to please?
Post reply on HN